SafeMoon, a decentralized finance (DeFi) protocol built on the Binance Smart Chain, was hacked last month resulting in the loss of 27,000 Binance Coin (BNB) worth approximately $8.9 million. However, the hacker responsible for the theft has recently returned 80% of the stolen funds.
Yesterday, the hackers pledged to return the 80% funds as per the blockchain message released by SafeMoon. The message included an encoded message in Unicode Transformation Format (UTF-8) from the attacker’s address that was used as the beneficiary in a transaction uploaded to the Binance Smart Chain from the SafeMoon Deployer account on April 18 at 1:19 p.m. UTC.
The hacker and the SafeMoon team have been in communication since the hack took place, and this is the latest exchange in mediation efforts. The SafeMoon team earlier also had requested the attacker to provide a Telegram handle for communication, but instead, the hacker provided an anonymous Outlook email address. Hackers claimed to have mistakenly emptied the funds on March 29.
Hack was caused by a Public Token Bug
The hack on SafeMoon was caused by a public token bug that allowed the attacker to drain wrapped BNB (WBNB) from the protocol by taking advantage of the public burn function. This allowed the attacker to remove SafeMoon’s native token SFM from the project’s WBNB liquidity pool, resulting in an artificial spike in the price of SFM. The attacker then sold the overpriced SFM tokens back into the same liquidity pool, wiping out the remaining WBNB.
The incident highlights the importance of security measures in the DeFi sector, which is growing rapidly, but is still largely unregulated. DeFi protocols need to prioritize security and take measures to prevent such attacks.
***
